Currently, many network data processing systems employ correlation and automation solutions to aid in acting within complex environments, conditions and situations. These solutions are employed to consolidate, correlate and analyze information arising from computer-monitored user or system activities (or “events”) occurring within or across network systems to quickly and accurately identify and take action in response to a condition or problem. Processes or actions may be taken to adjust, fix, reconfigure or provision resources to solve the problem when the cause is determined. These correlation and automation solutions are also referred to as complex event processing (CEP) solutions.
Complex event processing (CEP) is the derivation of high-level events from the analysis, correlation, and summarization of low-level events in event-driven systems. These high-level events (called “complex events”) are suitable for notifying people of conditions, opportunities or problems in easy-to-understand terms (or for triggering automated processes) so that action can be taken to produce a desired result. The term “event-driven architecture” refers to any applications that react intelligently to changes in conditions, such as the impending failure of a hard drive or a sudden change in stock price. One of the emerging styles of service interactions is the event-driven style. Event-Driven Architecture (EDA) is emerging as a variant of Service Oriented Architecture (SOA) that is being supported by multiple vendors. EDA systems are widely used in enterprise integration applications; including for example time-critical systems, agile process integration systems, managements of services and processes, delivery of information services, and awareness to business situations. There is a range of event processing middleware capabilities (i.e., software that mediates between an application program and a network); including publish-subscribe services (which have been incorporated into standards such as JMS—Java Message Service), commercial systems, mediation services (such as event transformation, aggregation, split and composition) and event pattern detection (complex event processing). The CEP software program must be prepared to respond to a variety of events in unpredictable sequences and combinations.
In a CEP environment there are many different applications that produce and/or utilize “events”. Each application that either generates or acts upon events may require a different “event format” for specifying and organizing the characteristics and properties (or “attributes”) of the data and instructions (such as their types, sequences and relationships, etc.) that are utilized in processing the event. Applications that must process events from multiple sources, such as a CEP software component (or “engine”), must be capable of accessing and acting upon these different event formats in a standard manner. In addition, the software user or programmer must have access to the “metadata” globally defining the attributes of these events (and their formats), when a graphical user programming interface (GUI) is employed to build operational rules (or “artifacts”) that enable the CEP engine to act upon the events. Usually multiple event types with different associated attributes exist within each format that all must be easily accessible using the GUI, so the user can select those attributes of a given event and define logical expressions upon this event to determine if it should be selected by the CEP “rules” in producing a desired result.
Existing programming solutions, such as those described in U.S. Pat. Nos. 6,549,956; 6,253,367; 6,145,009 & 6,138,121 and in U.S. Patent Publication Nos. 2005/0160134; 2004/0073566 & 2002/0010804 (the disclosures of which are all incorporated by reference as if fully set forth herein), either require all events to be converted to a common format or do not permit different event formats to be processed by the same CEP engine. In the first instance, there is a disadvantage in requiring the program user to translate (or “map”) the original format to the common format. A degradation in system processing performance also occurs when converting all of the attributes of the original event to the common format. In the second instance, important “cross-correlation” features existing between different events may be lost for those event formats that cannot be processed.